proxytunnel-users — Discussion list for proxytunnel users

[Proxytunnel-users] Can't get proxytunnel to work: socket write error

[Niels H. <ha...@ho...>]

Hello,
I can't seem to get proxytunnel to work on my apache vhost. My host has an SSH daemon running on port 2234.
VHOST CONFIG<VirtualHost *:443>  ServerName connect.website.com
  SSLEngine On  SSLCertificateFile /etc/ssl/cert.pem  SSLCertificateKeyFile /etc/ssl/privkey.pem  SSLCertificateChainFile /etc/ssl/fullchain.pem
  #HostnameLookups on  ProxyRequests On  ProxyVia on
  AllowCONNECT 2234 #SSH ON 2234
#  <Proxy *>#    Order deny,allow#    Deny from all#  </Proxy>#  <Proxy 127.0.0.1>#    Order deny,allow#    Allow from all#  </Proxy>
  DocumentRoot /var/www/connect</VirtualHost>

SSH CONFIGHost hazcod  ServerAliveInterval 30  ProxyCommand proxytunnel -v -X -p proxy.company.com:3128 -P 'companyuser:companypass' -r connect.website.com:443 -d 127.0.0.1:2234 -H "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)"

LOGhazcod@django:~$ ssh hazcodSSL local to remote proxy enabledLocal proxy proxy.company.com resolves to 2.xxx.xxx.xxxConnected to proxy.companycom:3128 (local proxy)
Tunneling to connect.website.com:443 (remote proxy)Communication with local proxy: -> CONNECT connect.website.com:443 HTTP/1.0 -> Proxy-Authorization: Basic xxxxx= -> Proxy-Connection: Keep-Alive -> User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) <- HTTP/1.1 200 Connection established
Tunneling to 127.0.0.1:2234 (destination)Communication with remote proxy: -> CONNECT 127.0.0.1:2234 HTTP/1.0 -> Proxy-Connection: Keep-Alive -> User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)error: Socket write error.

Any ideas? Thanks.Regards

 		 	   		  

Re: [Proxytunnel-users] Apache timing out proxy connection

[Neil B. <ph...@fn...>]

On 26/03/15 19:29, Neil Bird wrote:
>    I'm trying to resurrect my proxytunnel configuration, but I'm
> suffering something I didn't see when I last tried it OK.
> mod_proxy_connect.c(183): (70007)The timeout specified has expired: [client 127.0.0.1:39863] AH01018: error on client - ap_get_brigade

   No ideas why this is a fix, but it seems to solve it for me:

     # Inside <VirtualHost _default_:443>
     RequestReadTimeout header=0,MinRate=500 body=0,MinRate=500


   From http://blog.halberom.co.uk/mod_proxy_connect-and-mod_reqtimeout.html

-- 
[phoenix@fnx ~]# rm -f .signature
[phoenix@fnx ~]# ls -l .signature
ls: .signature: No such file or directory
[phoenix@fnx ~]# exit

[Proxytunnel-users] Apache timing out proxy connection

[Neil B. <ph...@fn...>]

   I'm trying to resurrect my proxytunnel configuration, but I'm 
suffering something I didn't see when I last tried it OK.

   I'm connecting fine (via Apache on localhost https:443 + connect 
localhost:22), but the connection is killed, seemingly by Apache, after 
~30 seconds (whether the connection is being used or not):

error: Socket read error: [104] Connection reset by peer
 
Write failed: Broken pipe


   The Apache logs report:

mod_proxy_connect.c(183): (70007)The timeout specified has expired: 
[client 127.0.0.1:39863] AH01018: error on client - ap_get_brigade


   I have keep-alive set in my SSH config. but have failed to get Apache 
to accept anything like it in its config. ,mas the various options 
require a fixed <Proxy[Match] URL> but I have a * and a regex filter.


   Any ideas what I'm missing?

-- 
[phoenix@fnx ~]# rm -f .signature
[phoenix@fnx ~]# ls -l .signature
ls: .signature: No such file or directory
[phoenix@fnx ~]# exit

Re: [Proxytunnel-users] TLS Upgrade and SNI Authentication

[Alexander H. <pro...@fr...>]

Forgot to attach.

– Alex
On Mar 25, 2015 11:36 PM, "Alexander Huynh" <pro...@fr...ffee>
wrote:

> Hey,
>
> I've written a patch to upgrade the encryption to TLS version 1.2, which
> also has the SNI extension.
>
> Please see attached.
>
> Thanks,
>
> – Alex
>

[Proxytunnel-users] TLS Upgrade and SNI Authentication

[Alexander H. <pro...@fr...>]

Hey,

I've written a patch to upgrade the encryption to TLS version 1.2, which
also has the SNI extension.

Please see attached.

Thanks,

– Alex

[Proxytunnel-users] TLS Upgrade and SNI Authentication

[Alexander H. <al...@fr...>]

Hey,

I've written a patch to upgrade the encryption to TLS version 1.2, which
also has the SNI extension.

Please see attached.

Thanks,

– Alex

[Proxytunnel-users] Error 403

[Mauricio P. <mau...@gm...>]

I have the following error, any idea to solve it?
Thank you

u84839@WS83902114 ~
$ ssh 190.xxx.xx.xx
Local proxy XXXX resolves to 10.xx.xx.xx
Connected to XXXX :80 (local proxy)

Tunneling to 190.xxx.xx.xx:443 (remote proxy)
Communication with local proxy:
-> CONNECT 190.xxx.xx.xx:443 HTTP/1.0
-> Proxy-Connection: Keep-Alive
-> User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)\n
<- HTTP/1.0 403 Forbidden
HTTP return code: 403 Forbidden
<- Date: Fri, 24 Oct 2014 13:55:56 GMT
<- Proxy-Connection: Keep-Alive
<- Via: 1.1 wcg-proxy.xxx.xx.ar
<- Content-Length: 340
ssh_exchange_identification: Connection closed by remote host

[Proxytunnel-users] Apache 2.4 Proxy Connect - connection reset

[Vladimir-M. O. <vo...@gb...>]

Hello,

I have a working setup with apache 2.2 server acting as a remote proxy.

I'm using proxytunnel with two chained proxies: proxytunnel -q -X -p
localproxy:8080 -r remoteproxy:443 -d destination:22

I had to apply a patch for SSL to work though:
https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

I'm now trying to do the same using the apache 2.4 server build
2.4.6-ubuntu (the above SSL issue is resolved in 2.4). The connection
establishes immediately but after cca 20 seconds apache (remoteproxy)
resets the connection to the local proxy, thus killing my SSH session.
Keepalives for the SSH session didn't help.

I tried raising the log level LogLevel debug in the general apache config,
but i'm not seeing any useful info.

Later on found out about trace1-8 debug levels but that ALSO doesn't show
anything. Using LogLevel warn proxy:trace6 proxy_connect:trace6. In packet
traces I'm just seeing sudden FIN/ACK from remoteproxy->destination and
RST/ACK from remoteproxy->localproxy. No mention of any proxy activity
inside /var/log/apache2. Only a single CONNECT line.


Any suggestions?

Thanks.

BR,
Vladimir

Re: [Proxytunnel-users] proxytunnel with squid - error 403

[Dag W. <da...@wi...>]

On Fri, 29 Jul 2011, Przemysław Kukulski wrote:

> I'm trying to get proxytunnel working on my configuration based on article:
> http://www.saulchristie.com/how-to/bypass-firewalls
>
> localhost proxy (squid: 3128) -> remotehost:80 -> remotessh:443 (also tried
> port 22)
>
>
> $ proxytunnel -v -p 127.0.0.1:3128 -r remotehost:80 -R user:pass -d
> remotessh:443
> Connected to 127.0.0.1:3128 (local proxy)
>
> Tunneling to remotehost:80 (remote proxy)
> Communication with local proxy:
> -> CONNECT remotehost:80 HTTP/1.0
> -> Proxy-Connection: Keep-Alive
> <- HTTP/1.0 403 Forbidden
> HTTP return code: 403 Forbidden
> <- Server: squid/2.7.STABLE9
> <- Date: Fri, 29 Jul 2011 19:52:30 GMT
> <- Content-Type: text/html
> <- Content-Length: 1162
> <- X-Squid-Error: ERR_ACCESS_DENIED 0
> <- X-Cache: MISS from notebook
> <- X-Cache-Lookup: NONE from notebook:3128
> <- Via: 1.0 notebook:3128 (squid/2.7.STABLE9)
> <- Connection: close
>
> I've checked squid logs and I found:
>
> 1311968525.813      0 127.0.0.1 TCP_DENIED/403 1468 CONNECT remotehost:80 -
> NONE/- text/html
>
> My localhost squid is standard configuration which include:
>
> http_access deny CONNECT !SSL_ports
>
> acl Safe_ports port 80          # http
> acl Safe_ports port 21          # ftp
> acl Safe_ports port 443        # https
>
> So based on that configuration CONNECT on port 80 should be permitted.
> If i disable this acl rule - everything works fine, but unfortunately it's
> not an option. Is there any way to make proxytunnel work on such
> configuration or am I missing something?

Sorry, I only now noticed your email.

The obvious error seems to me that the first ACL rule denies CONNECT from 
anything but SSL_ports. From your configuration you add port 80 to 
Safe_ports, but not to SSL_ports. So you either have to add !Safe_ports to 
the http_access line, or add port 80 to yhe SSL_ports acl.

But you probably already figured that out by now ;-)

-- 
-- dag wieers, da...@wi..., http://dag.wieers.com/
-- dagit linux solutions, in...@da..., http://dagit.net/

[Any errors in spelling, tact or fact are transmission errors]

[Proxytunnel-users] proxytunnel with squid - error 403

[Przemysław K. <prz...@gm...>]

Hello!


I'm trying to get proxytunnel working on my configuration based on article:
http://www.saulchristie.com/how-to/bypass-firewalls

localhost proxy (squid: 3128) -> remotehost:80 -> remotessh:443 (also tried
port 22)


$ proxytunnel -v -p 127.0.0.1:3128 -r remotehost:80 -R user:pass -d
remotessh:443
Connected to 127.0.0.1:3128 (local proxy)

Tunneling to remotehost:80 (remote proxy)
Communication with local proxy:
 -> CONNECT remotehost:80 HTTP/1.0
 -> Proxy-Connection: Keep-Alive
 <- HTTP/1.0 403 Forbidden
HTTP return code: 403 Forbidden
 <- Server: squid/2.7.STABLE9
 <- Date: Fri, 29 Jul 2011 19:52:30 GMT
 <- Content-Type: text/html
 <- Content-Length: 1162
 <- X-Squid-Error: ERR_ACCESS_DENIED 0
 <- X-Cache: MISS from notebook
 <- X-Cache-Lookup: NONE from notebook:3128
 <- Via: 1.0 notebook:3128 (squid/2.7.STABLE9)
 <- Connection: close

I've checked squid logs and I found:

1311968525.813      0 127.0.0.1 TCP_DENIED/403 1468 CONNECT remotehost:80 -
NONE/- text/html

My localhost squid is standard configuration which include:

http_access deny CONNECT !SSL_ports

acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443        # https

So based on that configuration CONNECT on port 80 should be permitted.
If i disable this acl rule - everything works fine, but unfortunately it's
not an option. Is there any way to make proxytunnel work on such
configuration or am I missing something?


-- 

Greetings DimmuR

[Proxytunnel-users] analyze_HTTP: readline failed: Connection closed by remote host

[Perl W. <who...@gm...>]

I'm running stunnel on the server. When I connect, I get the OpenSSH
banner but it exits with an error after that.

OpenSSH_5.5p1, OpenSSL 1.0.0a-fips 1 Jun 2010
debug1: Reading configuration data /home/pwh/.ssh/config
debug1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Executing proxy command: exec proxytunnel -vp
192.168.1.100:3029 -r mydomain.com:443 -d mydomain.com:22 -X
debug1: identity file /home/pwh/.ssh/id_rsa type 1
debug1: identity file /home/pwh/.ssh/id_rsa-cert type -1
debug1: identity file /home/pwh/.ssh/id_dsa type -1
debug1: identity file /home/pwh/.ssh/id_dsa-cert type -1
debug1: permanently_drop_suid: 500
SSL local to remote proxy enabled
Connected to 192.168.1.100:3029 (local proxy)

Tunneling to backup.mydomain.com:443 (remote proxy)
Communication with local proxy:
 -> CONNECT backup.mydomain.com:443 HTTP/1.0
 -> Proxy-Connection: Keep-Alive
 <- HTTP/1.0 200 Connection established
 <- Proxy-agent: tinyproxy/1.8.2

Tunneling to backup.mydomain.com:22 (destination)
Communication with remote proxy:
 -> CONNECT backup.mydomain.com:22 HTTP/1.0
 -> Proxy-Connection: Keep-Alive
 <- SSH-2.0-OpenSSH_5.1p1 Debian-5
analyze_HTTP: readline failed: Connection closed by remote host
ssh_exchange_identification: Connection closed by remote host

What am I doing wrong?

[Proxytunnel-users] Doesn't authenticate with NTLM user/pass

[Perl W. <who...@gm...>]

I tried proxytunnel 1.9.0

Command: proxytunnel.exe -v -N -p myproxy.com:80 -r mydomain.com:443 -d
mydomain.com:22 -X -H "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1;
en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10\r" -P username:password

It detects the domain correctly but doesn't authenticate.

Here is the full output.

SSL local to remote proxy enabled
Build Type 1 NTLM Message : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Local proxy proxy resolves to 1.2.3.4
Connected to proxy:80 (local proxy)

Tunneling to mydomain.com:443 (remote proxy)
Communication with local proxy:
 -> CONNECT mydomain.com:443 HTTP/1.0
 -> Proxy-Authorization: NTLM XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx
 -> Proxy-Connection: Keep-Alive
 -> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.10)
Gecko/20100914 Firefox/3.6.10\r
 <- HTTP/1.1 407 Proxy Authentication Required ( Access is denied.  )
HTTP return code: 407 Proxy Authentication Required ( Access is denied.  )
 <- Via: 1.1 XXXXXXXXXXx
 <- Proxy-Authenticate: NTLM XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx
parse_type2: Signature mat...@li...
NTLM Got Domain: XXXXXXX
NTLM Domain: XXXXXXX
NTLM Got Challenge: XXXXXXX
NTLM: MD4 of password is: XXXXXXX
DOMAIN: XXXXXXX
USER: XXXXXXX
userdom is: XXXXXXXXXXXXXXXXXXXXXXXX
HMAC_MD5 of userdom keyed with MD4 pass is: XXXXXXXXXXXX
client_challenge is: XXXXXXX
HMAC is: XXXXXXXXXXXXXXXXXXXXx
 <- Connection: Keep-Alive
 <- Proxy-Connection: Keep-Alive
 <- Pragma: no-cache
 <- Cache-Control: no-cache
 <- Content-Type: text/html
 <- Content-Length: 0

Tunneling to mydomain.com:443 (remote proxy)
Communication with local proxy:
 -> CONNECT mydomain.com:443 HTTP/1.0
 -> Proxy-Authorization: NTLM XXXXXXXXX
 -> Proxy-Connection: Keep-Alive
 -> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.10)
Gecko/20100914 Firefox/3.6.10\r
 <- HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires
authorization to fulfill the request. Access to the Web Proxy filter is
denied.  )
HTTP return code: 407 Proxy Authentication Required ( The ISA Server
requires authorization to fulfill the request. Access to the Web Proxy
filter is denied.  )

Tunneling to mydomain.com:443 (remote proxy)
Communication with local proxy:
 -> CONNECT mydomain.com:443 HTTP/1.0
 -> Proxy-Authorization: NTLM XXXXXXXXXXXXXXXX
 -> Proxy-Connection: Keep-Alive
 -> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.10)
Gecko/20100914 Firefox/3.6.10\r
 <- Via: 1.1 XXXXXXXXXXXx
 <- Proxy-Authenticate: Negotiate
 <- Proxy-Authenticate: Kerberos
 <- Proxy-Authenticate: NTLM
 <- Connection: close
 <- Proxy-Connection: close
 <- Pragma: no-cache
 <- Cache-Control: no-cache
 <- Content-Type: text/html
 <- Content-Length: 731
 <- <HTML><HEAD><TITLE>Error Message</TITLE>
 <- <META http-equiv=Content-Type content="text/html; charset=windows-1252">
 <- <BODY>
 <- <TABLE><TR><TD id=L_dt_1><B>Network Access Message: The page cannot be
displayed<B></TR></TABLE>
 <- <TABLE><TR><TD height=15></TD></TR></TABLE>
 <- <TABLE>
 <- <TR><TD id=L_dt_2>Technical Information (for Support personnel)
 <- <UL>
 <- <LI id=L_dt_3>Error Code: 407 Proxy Authentication Required. The ISA
Server requires authorization to fulfill the request. Access to the Web
Proxy filter is denied. (12209)
 <- <LI id=L_dt_4>IP Address: 1.2.3.4
 <- <LI id=L_dt_5>Date: 10/11/2010 8:11:52 AM [GMT]
 <- <LI id=L_dt_6>Server: proxydomain.com
 <- <LI id=L_dt_7>Source: proxy
 <- </UL></TD></TR></TABLE></BODY></HTML>
error: Socket read error: [113] Software caused connection abort

Re: [Proxytunnel-users] Proxytunnel -e and OpenSSH server

[Dag W. <da...@wi...>]

On Thu, 7 Oct 2010, David BERCOT wrote:

> I'd like to use proxytunnel to connect to my ssh server through a
> proxy.
> Because the first part of the connection is not encrypted
> (negotiation), the proxy doesn't allow this. So, I think I have to use
> the -e option.
> But, in this case, my OpenSSH server (Debian, 5.5p1-5) does not
> understand !!!
>
> Do you have any solution ?

Use stunnel on the receiving side, or set up an HTTPS proxy yourself.

-- 
--   dag wieers,  da...@wi...,  http://dag.wieers.com/   --
[Any errors in spelling, tact or fact are transmission errors]

[Proxytunnel-users] Proxytunnel -e and OpenSSH server

[David B. <de...@be...>]

Hello,

I'd like to use proxytunnel to connect to my ssh server through a
proxy.
Because the first part of the connection is not encrypted
(negotiation), the proxy doesn't allow this. So, I think I have to use
the -e option.
But, in this case, my OpenSSH server (Debian, 5.5p1-5) does not
understand !!!

Do you have any solution ?

Thank you.

David.

Re: [Proxytunnel-users] HTTP CONNECT disabled - ramifications?

[Victor H. <vic...@ya...>]

>
> heya,


Thanks to everybody for their replies.

Well, that makes sense, we need SSL for many of our secure sites. At least
now I understand the background a bit more =).

I've mucking around, and I noticed that even with proxytunnel:

proxytunnel -v -p localproxy:8080 -r remotewebserver.com:80 -d
destinationsshserver.com:22 -H "Mozilla/5.0 (Windows; U; Windows NT 6.1; fr;
rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9"


in the output, it just seems to return the proxy's "Access Denied" page,
with a "301 Moved Permanently", Proxy-Connection is "close", and
X-Error-Name is "httpmethodfilterlist". I suppose that's a win for
security...hmm.

With both -e and -X, we also still gets an "Access Denied".

However, with -E, I get a "error: Socket write error".

(Note, I haven't done anything fancy on the remotewebserver to get SSL to
work properly. I did vaguely follow the instructions at
http://beginlinux.com/blog/2009/01/ssl-on-ubuntu-810-apache2/, but that's
about it. And there's nothing SSL specific in the virtualhost config for the
hostname I'm using for the remotwebserver.com).

First question, and my apologies if this is a bit basic - how is it we are
still able to pickup the proxy connection, and deny access? I thought this
method was meant to be able to tunnel through proxies?

Secondly - any ideas on what the "Socket write error" with the -E flag
means?

Cheers,
Victor

On 17 August 2010 01:08, Julian Gilbey <ju...@d-...> wrote:

> On Mon, Aug 16, 2010 at 11:18:56PM +1000, Victor Hooi wrote:
> > Hi,
> >
> > I'm curious - proxy tunnel doesn't work if HTTP CONNECT is disabled,
> right?
> > My background info on the HTTP spec is a little patchy, all I could seem
> to
> > find on the background was a single line in RFC2616 (
> > http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html).
> >
> > Is it normal for a proxy server to disable HTTP CONNECT? Are there any
>
> What you might find is what I did with one proxy server: it allowed
> one to CONNECT to the remote server but did not allow one to send an
> HTTP CONNECT request _to_ the remote server, so you could not connect
> to a further service via the remote server.  The only way around this
> was to connect to an SSL-encrypted remote server, so that the proxy
> was not able to see the HTTP CONNECT request.
>
>   Julian
>

Re: [Proxytunnel-users] HTTP CONNECT disabled - ramifications?

[Mark J. <ma...@ma...>]

On Mon, 2010-08-16 at 23:18 +1000, Victor Hooi wrote:

> Is it normal for a proxy server to disable HTTP CONNECT? 
No... as then SSL websites would _NOT_ work anymore

> Are there any
> ramifications if a proxy disables it? What ways could a user use to

Yes, if you can access SSL websites CONNECT should be enabled.
You can try running a telnet connection to the proxy:

Try something like this:
--------------------------------------------------
$ telnet <yourproxy> <port> 
Trying 10.x.x.x...
Connected to yourproxy.
Escape character is '^]'.
CONNECT nerdnet.nl:443 HTTP/1.0

HTTP/1.0 200 Connection established

SSH-2.0-OpenSSH_5.1p1 Debian-5

Protocol mismatch.
Connection closed by foreign host.
--------------------------------------------------

If that doens't give an error, it should be ok


> determine if HTTP CONNECT was allowed, short of actually trying to use
> something like proxytunnel? And even then, could they categorically say that
> it was disabled, as opposed to something else?

They could technically enable it only for 'trusted' ip's. (either on the
inside, or on the outside).

> Are there any workarounds to getting proxytunnel to work, if HTTP CONNECT is
> disabled through the proxy?

No, but if it allows connects, but dis-allows (detects) proxytunnel, you
can probably work around this with the SSL support built-in into
proxytunnel.



> 
> (Also, I noticed this article
> http://www.saulchristie.com/how-to/bypass-firewalls seems to imply that its
> method, using proxytunnel will work on any firewall/proxy - however, that's
> not true if HTTP CONNECT is disabled, right? Or is it?)

True... but I have yet to ever encounter a proxy with CONNECT disabled,
because, as stated, it would block SSL websites...

-- 
Mark Janssen -- Sig-I/O Automatisering
ma...@si...  http://sig-io.nl
Linux, Unix, Networking, Hosting, Virtual Private Servers and more

Re: [Proxytunnel-users] HTTP CONNECT disabled - ramifications?

[Dag W. <da...@wi...>]

On Mon, 16 Aug 2010, Victor Hooi wrote:

> I'm curious - proxy tunnel doesn't work if HTTP CONNECT is disabled, right?
> My background info on the HTTP spec is a little patchy, all I could seem to
> find on the background was a single line in RFC2616 (
> http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html).
>
> Is it normal for a proxy server to disable HTTP CONNECT? Are there any
> ramifications if a proxy disables it? What ways could a user use to
> determine if HTTP CONNECT was allowed, short of actually trying to use
> something like proxytunnel? And even then, could they categorically say that
> it was disabled, as opposed to something else?
>
> Are there any workarounds to getting proxytunnel to work, if HTTP CONNECT is
> disabled through the proxy?
>
> (Also, I noticed this article
> http://www.saulchristie.com/how-to/bypass-firewalls seems to imply that its
> method, using proxytunnel will work on any firewall/proxy - however, that's
> not true if HTTP CONNECT is disabled, right? Or is it?)

If HTTP CONNECT is disabled, HTTPS will not work. So it's rare to find a 
HTTP proxy within companies or organizations that have HTTP CONNECT 
disabled.

Kind regards,
-- 
--   dag wieers,  da...@wi...,  http://dag.wieers.com/   --
[Any errors in spelling, tact or fact are transmission errors]

[Proxytunnel-users] HTTP CONNECT disabled - ramifications?

[Victor H. <vic...@ya...>]

Hi,

I'm curious - proxy tunnel doesn't work if HTTP CONNECT is disabled, right?
My background info on the HTTP spec is a little patchy, all I could seem to
find on the background was a single line in RFC2616 (
http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html).

Is it normal for a proxy server to disable HTTP CONNECT? Are there any
ramifications if a proxy disables it? What ways could a user use to
determine if HTTP CONNECT was allowed, short of actually trying to use
something like proxytunnel? And even then, could they categorically say that
it was disabled, as opposed to something else?

Are there any workarounds to getting proxytunnel to work, if HTTP CONNECT is
disabled through the proxy?

(Also, I noticed this article
http://www.saulchristie.com/how-to/bypass-firewalls seems to imply that its
method, using proxytunnel will work on any firewall/proxy - however, that's
not true if HTTP CONNECT is disabled, right? Or is it?)

Cheers,
Victor

[Proxytunnel-users] Apache + modproxy + SSL + ProxyTunnel

[Perl W. <who...@gm...>]

I followed the instructions at
http://dag.wieers.com/howto/ssh-http-tunneling/ to set up the tunnel but it
says this:

"proxytunnel has support for SSL tunneling by using the -e option.
Unfortunately we discovered a bug in Apache that causes CONNECT (mod_proxy)
to fail when SSL is being enabled."

Is anyone using such a setup? This is an old post and the bug is probably
fixed but I still am not able to get it to work.

Here is what I did

<VirtualHost *:80>
ServerName mail.mydomain.com
DocumentRoot /var/www/mail.mydomain.com        # Fake page at http just for
kicks

<Files ~ "^\.ht">
</Files>
<Directory />
    Options FollowSymLinks
    AllowOverride None
    Order deny,allow
    allow from all
</Directory>
</VirtualHost>

<VirtualHost *:443>
ServerName mail.mydomain.com
SSLEngine on
SSLCertificateFile /root/SSL/ssh-proxy/server.crt
SSLCertificateKeyFile /root/SSL/ssh-proxy/server.key
#ErrorLog /root/empty/ssh.log
HostnameLookups On
ProxyRequests on
AllowCONNECT 22 2022
ProxyVia on

<Proxy mail.mydomain.com>
</proxy>
</VirtualHost>

Re: [Proxytunnel-users] Patch to do non-blocking writes with associated openssl changes

[Jeffrey H. <jh...@ar...>]

On Nov 17, 2009, at 5:56 47PM, Mark Janssen wrote:

> On Tue, 2009-11-17 at 15:51 -0500, Jeffrey Haas wrote:
>> The attached patch against version 1.9.0 does two things:
>
> Attachments don't make it to the mailinglist, either include them
> in-line, or post them on the sf.net website.

The patch has been posted to the sf.net site.

-- Jeff

Re: [Proxytunnel-users] Patch to do non-blocking writes with associated openssl changes

[Mark J. <ma...@ma...>]

On Tue, 2009-11-17 at 15:51 -0500, Jeffrey Haas wrote:
> The attached patch against version 1.9.0 does two things:

Attachments don't make it to the mailinglist, either include them
in-line, or post them on the sf.net website.

Mark Janssen

[Proxytunnel-users] Patch to do non-blocking writes with associated openssl changes

[Jeffrey H. <jh...@ar...>]

The attached patch against version 1.9.0 does two things:

1. Makes the write sockets non-blocking.  We encountered issues with  
rsync stalling repeatedly through a proxytunnel because both sides  
were ready to read but neither side was able to write.
2. OpenSSL seems to get upset when the associated buffer with a non- 
blocking write moves around, even when setting the appropriate MOVE  
option.  Rather than spend another few days trying to figure out what  
I was missing in the OpenSSL API to make this correct, this patch  
associates a write buffer with each PTSTREAM.  When a write blocks,  
subsequent stream_copy calls will attempt to flush the write buffer  
first.  This is potentially inefficient in the SSL data stream since  
we really want to keep the encryption buffers full but I wasn't able  
to figure out exactly when it was safe to move data within a buffer.   
(See above.)

My apologies for gratuitously stomping on style and pre-existing API.   
I was more interested in getting this to work than into a clean  
project diff.

-- Jeff

Re: [Proxytunnel-users] HTTP/1.0 403 Forbidden by proxy

[Alexander <fr...@na...>]

Apparently your proxy does not allow connects to port 22.
Try running your sshd on a different port.
Kind regards,
Alex.

----- Message from js...@wi... ---------
     Date: Wed, 11 Nov 2009 13:22:23 +1100
     From: Jihad Saleh <js...@wi...>
  Subject: [Proxytunnel-users] HTTP/1.0 403 Forbidden by proxy
       To: pro...@li...


> Im trying set up tunneling through proxy at work and  and I'm having a
> problem getting my proxy server to let me through.
> this is my congig as follows.
> config file ssh :
> HOST www.yyyy.com.au
> ProxyCommand c:/proxytunnel/proxytunnel.exe -v -p "proxy.xxx.au:8080" -P
> "domain\username:password" -d %h:%p
>
>
> this is the debug message I get :
> C:\proxytunnel>ssh www.yyyy.com.au -v -l root
> OpenSSH_3.8.1p1, OpenSSL 0.9.7d 17 Mar 2004
> debug1: Reading configuration data /home/comp/.ssh/config
> debug1: Applying options for www.yyyy.com.au
> debug1: Reading configuration data /etc/ssh_config
> debug1: Executing proxy command: exec c:/proxytunnel/proxytunnel.exe -v -p "
> proxy.xxx.au:8080" -P "domain\\username:password" -d www.yyyy.com.au:22
> debug1: identity file /home/comp/.ssh/identity type -1
> debug1: identity file /home/comp/.ssh/id_rsa type -1
> debug1: identity file /home/comp/.ssh/id_dsa type -1
> Local proxy proxy.xxx.au resolves to 192.168.69.20
> Connected to proxy.xxx.au:8080 (local proxy)
> Tunneling to www.yyyy.com.au:22 (destination)
> Communication with local proxy:
>  -> CONNECT www.yyyy.com.au:22 HTTP/1.0
>  -> Proxy-Authorization: Basic aXRkc3lkXHN1bl9lbmdpbmVlcjpQYXNzdzByZA==
>  -> Proxy-Connection: Keep-Alive
>  <- HTTP/1.0 403 Forbidden by proxy
> HTTP return code: 403 Forbidden by proxy
>  <- Date: Wed, 11 Nov 2009 02:18:07 GMT
>  <- Content-length: 5165
>  <- Content-type: text/html
> ssh_exchange_identification: Connection closed by remote host
>
>
>
>
>
>
> --
> ---------------------------
> Jihad Saleh
> Wizard IT Service P/L
> 0410595989
> js...@wi...
> -------------------------------
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Proxytunnel-users mailing list
> Pro...@li...
> https://lists.sourceforge.net/lists/listinfo/proxytunnel-users
>


----- End message from js...@wi... -----



========================================================================
#    _  __          _ __     http://www.nagilum.org/ \n icq://69646724 #
#   / |/ /__ ____ _(_) /_ ____ _  na...@na... \n +491776461165 #
#  /    / _ `/ _ `/ / / // /  ' \  Amiga (68k/PPC): AOS/NetBSD/Linux   #
# /_/|_/\_,_/\_, /_/_/\_,_/_/_/_/ Mac (PPC): MacOS-X / Linux / MacOS-X #
#           /___/     x86: FreeBSD/Linux/Solaris/Win2k  ARM9: EPOC EV6 #
========================================================================


----------------------------------------------------------------
cakebox.homeunix.net - all the machine one needs..

[Proxytunnel-users] HTTP/1.0 403 Forbidden by proxy

[Jihad S. <js...@wi...>]

Im trying set up tunneling through proxy at work and  and I'm having a
problem getting my proxy server to let me through.
this is my congig as follows.
config file ssh :
HOST www.yyyy.com.au
ProxyCommand c:/proxytunnel/proxytunnel.exe -v -p "proxy.xxx.au:8080" -P
"domain\username:password" -d %h:%p


this is the debug message I get :
C:\proxytunnel>ssh www.yyyy.com.au -v -l root
OpenSSH_3.8.1p1, OpenSSL 0.9.7d 17 Mar 2004
debug1: Reading configuration data /home/comp/.ssh/config
debug1: Applying options for www.yyyy.com.au
debug1: Reading configuration data /etc/ssh_config
debug1: Executing proxy command: exec c:/proxytunnel/proxytunnel.exe -v -p "
proxy.xxx.au:8080" -P "domain\\username:password" -d www.yyyy.com.au:22
debug1: identity file /home/comp/.ssh/identity type -1
debug1: identity file /home/comp/.ssh/id_rsa type -1
debug1: identity file /home/comp/.ssh/id_dsa type -1
Local proxy proxy.xxx.au resolves to 192.168.69.20
Connected to proxy.xxx.au:8080 (local proxy)
Tunneling to www.yyyy.com.au:22 (destination)
Communication with local proxy:
 -> CONNECT www.yyyy.com.au:22 HTTP/1.0
 -> Proxy-Authorization: Basic aXRkc3lkXHN1bl9lbmdpbmVlcjpQYXNzdzByZA==
 -> Proxy-Connection: Keep-Alive
 <- HTTP/1.0 403 Forbidden by proxy
HTTP return code: 403 Forbidden by proxy
 <- Date: Wed, 11 Nov 2009 02:18:07 GMT
 <- Content-length: 5165
 <- Content-type: text/html
ssh_exchange_identification: Connection closed by remote host






-- 
---------------------------
Jihad Saleh
Wizard IT Service P/L
0410595989
js...@wi...
-------------------------------

Re: [Proxytunnel-users] ProxyTunnel with SIP

[michel f. <mi...@gm...>]

Dear All,

What i'm loking for is an HTTP tunnel server...The Client connected to that
tunnel will encapsulate UDP packets into HTTP packets and send them to the
server...The server will de encapsulate the packets and send them to their
destination...Does proxyTunnel do that job?

Regards

On Tue, Nov 3, 2009 at 4:58 PM, Mark Janssen <ma...@ma...> wrote:

> On Tue, 2009-11-03 at 10:18 +0200, michel freiha wrote:
> > Dear All,
> >
> > I'm working in the Voice Over Ip field and trying to develop my own
> > softphone...I was trying to find a useful tunnel server that can help me
> to
> > send SIP over http packets or any other type in order to bypass the block
> > done by some of the Internet Service providers on SIP protocol or SIP
> > port...
> >
> > I would like to ask you please if i can use this tunnel for that purpose
> or
> > not and how this tunnel works?
>
> Proxytunnel only set's up a HTTP 'CONNECT' type tunnel. I don't think
> that you'll have much use for it in a VoIP-application. Yes it will make
> a transparent connection, but UDP would probably suit you better.
>
> Maybe look into n2n or something like it ?
>
>